Lucene search
+L

168013 matches found

Nuclei
Nuclei
added 13 hours ago159 views

kkFileView 4.1.0 - Cross-Site Scripting

kkFileView 4.1.0 is susceptible to cross-site scripting via the url parameter at /controller/OnlinePreviewController.java. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS5.9AI score0.01084EPSS
SaveExploits1References2
Nuclei
Nuclei
added 13 hours ago84 views

AppWeb - Authentication Bypass

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types. id: CVE-2018-8715 info: name: AppWeb - Authentication...

8.1CVSS7.9AI score0.23287EPSS
SaveExploits2References5
Nuclei
Nuclei
added 13 hours ago117 views

Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

9.8CVSS8.3AI score0.12484EPSS
SaveExploits0References4
Nuclei
Nuclei
added 13 hours ago121 views

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

10CVSS9.5AI score0.09903EPSS
SaveExploits7References3
Nuclei
Nuclei
added 13 hours ago11 views

Discuz! X5.0 - Authentication Bypass

Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and loggingctl::loggingmore, letting unauthenticated remote attackers access database backup and restore functions, exploit requires...

9.3CVSS5.3AI score0.04194EPSS
SaveExploits4References4
Nuclei
Nuclei
added 13 hours ago24 views

FatPipe WARP/IPVPN/MPVPN - Backdoor Account

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain an account named "cmuser" with administrative privileges and no password, letting attackers gain unauthorized admin access, exploit requires no authentication. id: CVE-2021-27856 info: name: FatPipe...

9.8CVSS8.6AI score0.05598EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago82 views

ASUS DSL-AC88U - Authentication Bypass

A vulnerability in the ASUS DSL-AC88U router permits unauthorized individuals to bypass authentication.When adding "/js/..%2f%2f" or "/images/..%2f%2e" to the requested URL, it will be recognized as passing the authentication.This vulnerability is part of a broader authentication bypass issue...

9.8CVSS8.9AI score0.43456EPSS
SaveExploits0References3
Nuclei
Nuclei
added 13 hours ago111 views

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

6.1CVSS5.7AI score0.25607EPSS
SaveExploits1References1
Nuclei
Nuclei
added 13 hours ago21 views

WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting

WordPress Skaut Bazar plugin before 1.3.3 contains a reflected cross-site scripting vulnerability due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file, which allows attackers to inject arbitrary web scripts. id: CVE-2021-34643 info: name: WordPress Skaut Bazar 1.3.3 - Cross-Site...

6.1CVSS5.9AI score0.0235EPSS
SaveExploits2References5
Chainguard
Chainguard
added 15 hours ago2 views

GHSA-JGV4-5FJV-3XP7 vulnerabilities

Vulnerabilities for packages: consul-fips...

5.2AI score
SaveExploits0
Chainguard
Chainguard
added 15 hours ago4 views

CVE-2026-19016 vulnerabilities

Vulnerabilities for packages: consul-fips...

4.2CVSS5.2AI score0.00213EPSS
SaveExploits0
Chainguard
Chainguard
added 15 hours ago3 views

GHSA-7QHJ-3FG3-MH5R vulnerabilities

Vulnerabilities for packages: consul-fips...

5.2AI score
SaveExploits0
Chainguard
Chainguard
added 15 hours ago3 views

GHSA-JGRX-MGXX-JF9V vulnerabilities

Vulnerabilities for packages: arangodb...

5.2AI score
SaveExploits0
RedHat Linux
RedHat Linux
added yesterday3 views

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

10CVSS5.5AI score0.00765EPSS
SaveExploits1References8
RedHat Linux
RedHat Linux
added yesterday4 views

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

7.3CVSS5.4AI score0.00178EPSS
SaveExploits0References5
NVD
NVD
added yesterday7 views

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

5.3CVSS
SaveExploits0References10
CVE
CVE
added yesterday22 views

CVE-2026-73421

NextAuth.js vulnerability CVE-2026-73421 affects next-auth v5: when server configuration has an error (e.g., missing issuer/authorization, unset AUTH_SECRET), the auth() wrapper can return a truthy error object in middleware, Route Handlers, React Server Components, etc. As a result, existence-ba...

9.1CVSS5.4AI score
SaveExploits0References3
CVE
CVE
added yesterday14 views

CVE-2026-72856

Budibase before version 3.40.0 contains an authorization/authentication bypass in PUT /api/global/users/tenant/owner (changeTenantOwnerEmail). In self-hosted deployments (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL), cloudRestricted is a no-op and the route is protected only by a general authentication...

8.6CVSS5.4AI score
SaveExploits0References2
Cvelist
Cvelist
added yesterday19 views

CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

9.9CVSS
SaveExploits0References2
CVE
CVE
added yesterday23 views

CVE-2026-72842

The CVE-2026-72842 entry concerns luci-app-lxc on OpenWrt. It describes an ACL inconsistency that lets low-privileged, authenticated LuCI users access backend container management routes without proper authorization checks. A path traversal via /.%2E in the lxc_name parameter can escape container...

9.9CVSS5.8AI score
SaveExploits0References2
Rows per page
Query Builder